People are generally opposed to forking, right? If you fork a project, you effectively take over all the responsibilities to fix bugs and security issues etc.

People are generally opposed to forking, right? If you fork a project, you effectively take over all the responsibilities to fix bugs and security issues etc. in that project, which is, most of the time, more work that the fork is worth. Now, a popular recent trend is “vendoring” your dependencies; i.e. bundling the dependencies with your software. However, vendoring does not differ much from forking. The responsibility may be slightly less, since you only have to fix bugs and issues affecting your application’s usage of the software. But, just like a fork, the longer you go without merging from the upstream version, the more work it is to maintain your fork. I suggest that vendoring, just like forking, should be avoided, for largely the same reasons.